CVE-2025-22026: nfsd: don't ignore the return code of svc_proc_register()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't ignore the return code of svcprocregister()
Currently, nfsdprocstatinit() ignores the return value of svcprocregister(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later.
Fix nfsdprocstatinit() to return the same type of pointer as svcprocregister(), and fix up nfsdnetinit() to check that and fail the nfsdnet construction if it occurs.
svcprocregister() can fail if the dentry can't be allocated, or if an identical dentry already exists. The second case is pretty unlikely in the nfsdnet construction codepath, so if this happens, return -ENOMEM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.126.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22026?
CVE-2025-22026 has been classified with a moderate severity level.
How do I fix CVE-2025-22026?
To resolve CVE-2025-22026, update your Linux kernel to the latest stable version where the vulnerability has been patched.
What systems are affected by CVE-2025-22026?
CVE-2025-22026 affects the Linux kernel, specifically impacting systems utilizing the nfsd service.
When was CVE-2025-22026 disclosed?
CVE-2025-22026 was disclosed on January 25, 2025.
What are the consequences of exploiting CVE-2025-22026?
Exploiting CVE-2025-22026 could lead to potential denial-of-service conditions due to the ignored return code in the nfsd process.